machine hangs on occasion - correlated with ssh break-in attempts

Mikhail Teterin mi+mill at
Thu Aug 21 19:54:18 UTC 2008

Neil Neely написав(ла):
> I haven't explored this issue enough to speak with any authority - but 
> once upon a time I had an app doing tons of ipfw rule add/removes all 
> the time and we had no end of performance and stability problems on 
> that box (this would have been in 4.x or so timeline I expect).  As 
> that approach wasn't really critical we abandoned it without really 
> digging into the details.
> Years later a need for lots of rapid firewall changes came up again 
> and I drilled into it and found the use of tables was excellent for 
> doing this and it does the job very well.  This is approach is on a 
> FreeBSD 6.3 box.
> ipfw add 00550 deny ip from 'table(1)' to any
> Then just add remove entries to table 1 via:
> ipfw table 1 add
> ipfw table 1 delete
> show all entries in table 1 with:
> ipfw table 1 list
> Clear out the whole of table 1
> ipfw table 1 flush
> I can't be sure if this relates to your particular issue, but I would 
> recommend trying it out.
Thanks! I was not even aware of this functionality... Yes, I'll try that 
-- maybe, a bug in ipfw only hits once per 1000 invocations :-)


More information about the freebsd-stable mailing list